AgentFlow CVE-2026-7466

Exploitation requires the AgentFlow local web API to be running (agentflow serve, bound to 127.0.0.1:8000) and a request to POST /api/runs or POST /api/runs/validate that supplies a pipeline_path pointing to an existing Python pipeline file on disk - the endpoint executes a .py file already present, not attacker-uploaded source, so a malicious or abusable pipeline file must already exist locally. Exploitation is limited by several factors: the attacker must induce a request to the localhost-bound API (CVSS UI:P/AT:P - passive user interaction such as a victim visiting a malicious page, plus a passive attack requirement), the target must be on a vulnerable pre-1667fa3 build, and on patched builds path loading is disabled unless the operator has explicitly set AGENTFLOW_API_ALLOW_PIPELINE_PATH=1 and sends application/json.

The signals are consistent and point to a real-but-not-urgent issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H, score 7.7 High) reflects total confidentiality/integrity/availability impact but with a passive attack requirement (AT:P) and passive user interaction (UI:P), meaning exploitation is not fully attacker-at-will. SSVC reinforces this: Exploitation is none, Automatable is no, and Technical Impact is total. EPSS is very low at 0.04% (14th percentile), and the CVE is not on CISA KEV, so there is no evidence of active exploitation. The practical limiting factor the raw score understates is that the endpoint executes an existing Python file on disk rather than attacker-supplied source, and the API binds to localhost - so an attacker must both induce a request to the local control plane and have a malicious or abusable .py already present. Net: patch it, but treat this as a targeted local/CSRF-style concern rather than a mass-exploitable network RCE.

A developer runs 'agentflow serve' locally and browses to an attacker-controlled or malicious web page while a crafted or pre-planted .py pipeline exists on their disk (for example in a cloned repo or temp directory). The page issues a request to http://127.0.0.1:8000/api/runs with a JSON body setting pipeline_path to that file, causing AgentFlow to load and execute it as the local user. No public exploit is identified at time of analysis, but the attack is straightforward given the passive user interaction described by the CVSS vector.